CVE-2025-3616 Details
Description
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the gspb_make_proxy_api_request() function in versions 11.4 to 11.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The arbitrary file upload was sufficiently patched in 11.4.5, but a capability check was added in 11.4.6 to properly prevent unauthorized limited file uploads.
A vulnerability allowing arbitrary file uploads has been identified in the Greenshift animation and page builder blocks plugin for WordPress. This issue arises from inadequate file type validation in the 'gspb_make_proxy_api_request' function, affecting versions 11.4 to 11.4.5. The vulnerability allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server, potentially leading to remote code execution. While the arbitrary file upload vulnerability was patched in version 11.4.5, a capability check to prevent unauthorized limited file uploads was only introduced in version 11.4.6.
Users are advised to update the Greenshift WordPress plugin to version 11.4.6 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| greenshiftwp greenshift - animation and page builder blocks | >= 11.4, < 11.4.6 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2025 | Initial Analysis | [email protected] |
| Apr 22, 2025 | New CVE Received | [email protected] |